Feed Sign in with OpenID OpenID

Simon Willison’s Weblog

phpbb-openid: Your AIM screen name is your OpenID. Log in to a phpBB board with an AOL OpenID and it will try to associate your OpenID with an account that lists that AIM in the profile. This is the kind of behaviour I talked about in my FOWA talk.

Tagged , , , , ,

5 comments

  1. So is "this kind of behavior" a good thing?

    Dmitry Shechtman - 6th March 2007 10:04 - #

  2. Yes, definitely. OpenID is a classic example of the unix philosophy of one simple tool that solves a specific problem. The spec doesn't dictate what you can do with an OpenID identifier, and my pitch was that this gives you free reign to do all kinds of neat things based on your additional knowledge of the identity provider in question.

    I've seen people argue that this is against the spirit of OpenID - that you should never do anything special for a specific identity provider because it breaks the free nature of the system (where any identity provider can be used to log in to any consumer with no one getting special treatment). I disagree. OpenID doesn't dictate policy, it's a dumb protocol. I believe that the applications on the edges should be encouraged to innovate around the basic service that OpenID provides.

    Where standard ways of doing things across multiple identity providers exist, they should be used. In their absense I see nothing wrong with special casing on a per-provider basis.

    I wrote more about this here.

    Simon Willison - 6th March 2007 10:10 - #

  3. The only downside I can see right now is that it bloats the code of phpBB with hundreds of OpenID-Provider specific code.

    Christian Decker - 6th March 2007 14:24 - #

  4. "Hundreds"? That's exactly one special case. I only wish there were more. I blogged about it here.

    Dmitry Shechtman - 6th March 2007 20:15 - #

  5. There is a new phpBB OpenID MOD that has a lot more features than the current ones, and does not have the security flaw.

    http://zenorsoft.com/phpBB3/viewtopic.php?f=30&t=8 41

    Some features: Multiple OpenID URL's per user | Instant registration (no registration page to fill out if Simple Registration is supported on the provider) | Admins can manage/delete a URL in the ACP.

    Check it out and let me know what you think.

    JonZ - 10th July 2009 16:47 - #

Comments are closed.
A django site